CVE-2026-47723

Name of the Vulnerable Software and Affected Versions nebula-mesh versions prior to 0.3.0

Description Response paths in internal/web/ and internal/api/ do not implement standard browser-security headers. The absence of X-Frame-Options: DENY or frame-ancestors 'none' in the Content-Security-Policy (CSP) enables clickjacking attacks against administrators accessing /ui/operators/* or /ui/cas/*. Additionally, the lack of X-Content-Type-Options: nosniff allows MIME confusion on user-supplied content surfaces, and the absence of HTTP Strict Transport Security (HSTS) on TLS deployments creates a window for protocol downgrade attacks.

Recommendations For versions prior to 0.3.0, implement a response-header middleware at the chi router root for both /ui/* and /api/* paths to set the following headers: Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options, and Strict-Transport-Security for TLS requests.